Package · Wolfi

tofu-controller-runner

36 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

High 7.5

CVE-2026-56852 Public exploit

Infinite loop on invalid input in golang.org/x/text

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

golang.org/x/text golang.org/x/text/unicode/norm zot kubescape Debian Ubuntu Azure Linux Wolfi Go

Jul 21, 2026
Medium 6.5

CVE-2026-27145 Public exploit

Inefficient candidate hostname parsing in crypto/x509

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

Go standard library crypto/x509 golang stdlib Debian Ubuntu Azure Linux Wolfi Go

Jun 2, 2026
Critical 9.1

CVE-2026-33186 Public exploit

gRPC-Go has an authorization bypass via missing leading slash in :path

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests …

grpc grpc-go zot kubescape Debian Ubuntu Alpine Wolfi Go

Mar 20, 2026